libsixel vulnerabilities

libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, which never checks the GIF transparent color index against the palette size. Attackers can supply a crafted GIF with a small color table and large transparent index, processed with a background color set, to write bytes past the palette buffer, causing heap corruption or crashes.

In libsixel (a SIXEL encoder/decoder implementation) up to 1.8.7-r1, a wrong NULL check after an allocation call in sixel_decode_raw and sixel_decode causes a NULL pointer dereference whenever allocation fails. The check tests the address of the output parameter (always non-NULL) instead of the value returned by malloc, so on allocation failure the function continues and writes through a NULL pointer, crashing the process. The vulnerability is fixed in 1.8.7-r2.

The libsixel library has a signed integer overflow in the image-buffer doubling loop of the SIXEL parser, which can lead to an out-of-bounds heap write. This issue affects versions up to 1.8.7-r1 and is fixed in version 1.8.7-r2.

The libsixel library has a heap buffer overflow due to incorrect allocation size calculation in the sixel_encode_highcolor function. This issue affects versions from 1.8.7-r1 to 1.8.7-r2, where the lack of an upper bound for width and height allows for potential memory overwrites.

In libsixel versions 1.8.7 and prior, built with --with-gdk-pixbuf2, a use-after-free vulnerability exists in load_with_gdkpixbuf(). The cleanup path manually frees the sixel_frame_t object without consulting the reference count, leading to a dangling pointer. An attacker can supply a crafted image, potentially causing information disclosure, memory corruption, or code execution.